You may remember a blog where we talked about automating a capture so that it stops when a particular event shows up in the Windows Event Log. ( http://blogs.technet.com/netmon/archive/2007/02/22/eventmon-stopping-a-capture-based-on-an-eventlog-event.aspx
